Web & Access

Kaspersky Web Traffic Security (KWTS)

Kaspersky Web Traffic Security gateway logs — enterprise web proxy events covering allowed browsing, antivirus-scanned downloads, URL policy blocks, malware and phishing detections, and warning page redirects with custom kaspersky.kwts.* namespace fields in ECS-compatible JSON format.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/proxy-kaspersky-kwts/generator.yml \
  --id proxy-kaspersky-kwts \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
allowed	Normal browsing traffic allowed through proxy	~75%	web
allowed-scanned	File download scanned clean by antivirus engine	~10%	web
blocked-policy	Blocked by URL filtering policy	~6%	web
blocked-av	Blocked due to malware detection	~4%	web
blocked-ap	Blocked due to phishing detection	~3%	web
redirected	Redirected to warning page for risky content	~2%	web

Realism Features

Kaspersky antivirus engine verdicts with threat names and severity levels
URL category filtering with policy rule references
Anti-phishing detection with confidence scores and phishing URL patterns
HTTP method and MIME type distribution matching real proxy traffic profiles
Custom kaspersky.kwts.* namespace for product-specific fields
Russian-locale user and hostname pools for realistic CIS deployment scenarios

Sample Output

{
  "@timestamp": "2026-03-07T14:22:05.000Z",
  "event": {
    "category": [
      "web"
    ],
    "type": [
      "access"
    ],
    "outcome": "success",
    "action": "allowed",
    "module": "kaspersky",
    "dataset": "kaspersky.kwts"
  },
  "observer": {
    "vendor": "Kaspersky",
    "product": "Web Traffic Security",
    "version": "6.1.0.4762",
    "name": "KWTS-PROXY01",
    "ip": "10.1.0.50"
  },
  "kaspersky": {
    "kwts": {
      "action": "Allow",
      "scan_result": "Clean",
      "processing_time_ms": 12
    }
  },
  "url": {
    "domain": "mail.yandex.ru",
    "full": "https://mail.yandex.ru/inbox",
    "scheme": "https"
  },
  "http": {
    "request": {
      "method": "GET"
    },
    "response": {
      "status_code": 200,
      "bytes": 45230
    }
  },
  "source": {
    "ip": "10.1.20.34",
    "port": 52110
  },
  "user": {
    "name": "ivanov_av"
  },
  "host": {
    "hostname": "WS-BUH-PC03",
    "ip": "10.1.20.34"
  },
  "related": {
    "hosts": [
      "WS-BUH-PC03",
      "KWTS-PROXY01"
    ],
    "ip": [
      "10.1.20.34",
      "10.1.0.50"
    ],
    "user": [
      "ivanov_av"
    ]
  }
}

Parameters

Parameter	Default	Description
kwts_server	KWTS-PROXY01	KWTS proxy server hostname
kwts_server_ip	10.1.0.50	KWTS proxy server IP address
kwts_version	6.1.0.4762	KWTS product version
agent_id	a1b2c3d4-...	Filebeat agent UUID
agent_version	8.17.0	Elastic Agent version

Related Generators

Web & Access

Nginx Access & Error Logs

Nginx reverse proxy and web server — access logs with upstream timing, error logs with module context, bot/crawler traffic, scanner probes, and correlated 4xx/5xx error entries.

Web & Access

Apache HTTP Server

Apache httpd access and error logs — page/asset/API requests, bot crawlers (Googlebot, GPTBot), scanner probes, 3xx redirects, and correlated 4xx/5xx error log entries with module context.

Web & Access

Cisco AnyConnect VPN

Cisco ASA AnyConnect SSL VPN — session lifecycle from RADIUS authentication through tunnel establishment, IP assignment, DAP policy evaluation, session roaming between gateways, to graceful disconnection.